KEEP IT SAFE FINAL IT Security A6 FINAL 2 (1)
1 like144 views
This document provides guidance to staff and students on maintaining information security at Kingston University. It covers password protection, securing devices from theft, identifying phishing emails and malware, using encryption, and safely handling data. The Service Desk is available to assist with any IT security questions or incidents.
KEEP IT SAFE FINAL IT Security A6 FINAL 2 (1)
- 1. KEEP IT SAFEAn Information and Technology Services guide to security for staff and students INFORMATION AND TECHNOLOGY SERVICES @KU_ServiceDesk Follow us on Twitter Contact the Service Desk on 63355 or 020 8417 3355
- 2. Contents 01 Welcome from the Vice-Chancellor and CIO 02 Help and Support 03 Password Guidance 05 Email Security 09 Physical Security 11 Virus Protection 15 Data Handling 17 Credit / Debit Card and Online Payments 18 Reporting Security Incidents INFORMATION AND TECHNOLOGY SERVICES
- 3. Welcome – From the Vice Chancellor and CIO Everyone works with digital information and whilst the benefits are enormous for education, research and administration, technology exposes us to many security risks. A failure to secure the information we store has serious implications for the University, staff and students. Breaches carry significant financial penalties, not to mention damaging the reputation of the University or individuals. We continue to invest heavily in information security but the weakest link can often be people. This booklet provides some practical advice for staff and students to help identify security risks and remain safe whilst using IT at the University or elsewhere. The University has a duty to protect the personal, sensitive and financial information processed by its IT services, and you will no doubt be keen to ensure that the work you produce during your time here is safe from theft, loss or plagiarism. If you have questions after reading this booklet you can either visit the dedicated IT Security pages on StaffSpace or MyKingston or contact the Service Desk, who will be happy to help. Julius Weinberg Vice-Chancellor 01 Simon Harrison Chief Information Officer
- 4. 02 Keep IT Safe – Help and Support IT Service Desk The Service Desk offers help and support for any IT and Library related problems you may encounter throughout your time here. Support is available via the telephone, Monday to Friday between 08:00 and 18:30 by calling 020 8417 3355, or you can visit the IT Support pages at mykingston.kingston.ac.uk/mysupport/itsupport and staffspace.kingston.ac.uk/dep/it-services for online help and support. However if you are unable to login to the Service Desk Portal, please submit an online form at kusdpw.kingston.ac.uk giving us as much detail as possible about the problems you are experiencing with your computer. Follow the Service Desk on Twitter for regular IT service updates, news and support. Please also see the IT System Status on the My Kingston and StaffSpace homepages. Opening Hours Monday - Friday: 0800 - 1830 T: 020 8417 3355 W: portal.kingston.ac.uk @KU_ServiceDesk If you are concerned about a possible security incident, you should contact the Service Desk. Further information about security can also be found on My Kingston mykingston.kingston.ac.uk/mysupport/itsupport/Pages/security and StaffSpace staffspace.kingston.ac.uk/dep/it-services/Pages/Security StaffSpaceService Desk My Kingston
- 5. 03 Keep IT Safe – Password Guidance Your password is crucial to protecting the security of your account. Passwords ensure that only authorised users can access the University’s IT facilities. Your password keeps your stored data and information private and secure. What is a strong password? Criminals have developed programs that automate the ability to guess your password. Someone with minimal skills and with the right tools can easily guess short or normal words. The longer and more complex your password is, the more difficult it is to deduce or guess. Password strength tips: • Use long words, or preferably phrases, that are more difficult to guess • Use at least one upper case letter and a number to make it even harder to guess • Some examples of strong passwords based on the phrase ‘day follows night’ include: • ‘Dyfllwsnght’ which has the vowels removed • ‘D2yf0ll0wsn1ght’ which has all vowels replaced by numeric characters How can I protect my password? Do • Do use a ‘strong’ password • Do change it regularly, or if you think someone else may know it • Do use different passwords for different IT services, so that if someone gains access to your password it is of limited use to them Don’t • Don’t write your password down • Don’t let anyone else know your password • Don’t let anyone see you typing it • Don’t type your password into an open-text field, such as your username
- 6. 04 How do I change my password? Staff If you have forgotten your password you can change your password using the Password Changer. To use the staff email based Password Changer kusdpw.kingston.ac.uk/pass you will need to add your personal email address to the Content section of ‘Yourself’. If you have any questions please contact the Service Desk. Students If you have forgotten your password you can change your password using the Password Changer. To use the student Password Changer you should update your personal email address in ‘OSIS’. If you didn’t provide a personal email address, then you can contact the Service Desk. Yourself Password Changer
- 7. 05 Keep IT Safe – Email Security Phishing Email phishing is where a legitimate looking email is sent by a fraudster in an attempt to acquire sensitive information such as usernames, passwords, credit card details, bank details or other information. It is not uncommon to receive an email claiming to be from trustworthy sources with the intention of tricking you into providing sensitive and valuable data. How to spot a phishing email • The ‘from’ address may not be a real organisation domain • Think whether you are expecting an email correspondence from the organisation • The link in the email is different from the URL specified in the mail • The subject field is a generic statement • The message contains poor spelling and grammar • Unknown or suspicious attachments Do • Do hover your mouse over links and check the sender is legitimate • Do report incidents and phishing attacks to it-security@kingston.ac.uk Don’t • Don’t open any attachments you may consider suspicious • Don’t click on links you may consider suspicious • Don’t reply to the email
- 8. 06 From: Vincenzo Recupero <v.recupero@esattori.it> Sent: Mon 20/07/2015 11:07 To: Vincenzo Recupero Cc: Subject: R: Faculty and Staff Form Submission 1 2 3 4 5 6 7 8 9 10 Dear E-mail User. Your EMAIL ACCOUNT PASSWORD Expires TODAY, to UPDATE Please Click LOGON and Follow Instructions. Thanks 2015 ITS Help Desk Support Center Subject: Is too generic From: Not a Kingston University address I&TS never ask for users to provide user credentials Link: Not a Kingston University link http://facultyportalmail.tripod.com Click to follow link The example below illustrates the points previously described.
- 9. Keep IT Safe – Email Security SPAM SPAM is defined as the sending of unsolicited email to large groups of people. This will include large groups of University students and/or staff. If not necessarily malicious, SPAM can have a detrimental effect on the University’s computer network and, in some cases, can prevent important emails from reaching the intended recipient. Do • Do report large or excessive volumes of SPAM emails to it-security@kingston.ac.uk • Do look for tick-boxes that allow you to opt out of newsletters and special offers etc. Don’t • Don’t reply to SPAM emails • Don’t ‘reply all’ to University-wide emails • Don’t publish your email address on any website unless absolutely necessary, particularly on message boards and forums • Don’t give your email address to suspicious websites in order to download shareware or free programs 07
- 10. 08 Reporting suspicious emails You can help us handle phishing and SPAM emails by reporting any suspicious emails. We will submit suspicious emails to the Microsoft’s junk mail service, which in turn will mean they are marked and dealt with appropriately in the future. You should report any suspicious emails to it-security@kingston.ac.uk Don’t forward the original email, attach it to a new email as follows: In your University Outlook account: 1. Create a new email 2. Click on ‘Attach Item’ (envelope and paperclip icon at the top, just to the right of centre) then select ‘Outlook Item’ and the phishing email from the list of items 3. Send to it-security@kingston.ac.uk
- 11. 09 Keep IT Safe – Physical Security Laptop crime is on the rise and unattended devices are easy targets for thieves. Thieves will target computers, laptops and mobile phones in cars, coffee bars, libraries and even on public transport. Apple has a service called find my phone, which is available for users of Apple computers or phones. It is advisable to enable this feature if you can as it can help to protect or locate your devices if they are lost or stolen. Users of Windows or Linux devices can look at the https://preyproject.com/, which offers a similar service for such devices. If you have an android phone, then please go to www.lookout.com Reducing computer theft Staff computers or laptops should be secured and offices locked when unoccupied. A simple lock, cable and locked office door will deter the majority of opportunist thefts. Security locks Laptops, LCD monitors and most computers can be secured with a security lock and plastic coated steel cable. These come in a number of forms such as Kensington, the most well-known manufacturer. Variations on this theme include security plates that are bonded to two or more items and secured via a cable and lock.
- 12. 10 Locking your Computer If you are office based it is important to lock your device when leaving it unattended, and to turn it off at the end of each working day. This not only protects your device and its data, but also supports the University’s green agenda by using less power. If you are using one of the desktops in the LRC, then please remember to log out. All staff laptops provided since summer 2015 now use BitLocker encryption to provide an additional level of security for sensitive information stored on laptops. Staff with older laptops who deal with sensitive information and would benefit from Bitlocker (or FileVault for Apple devices) should please contact the Service Desk. Extra care should be taken when working on systems that contain sensitive data such as student information and financial data. Data loss incidents are far more likely to occur when a user leaves their workstation logged in but not locked. You should always ensure that you save your work to the H: drive. When working in open areas such as LRCs, computer labs or teaching rooms, you should never leave a computer unattended while it is logging off. The logoff process is not immediate and can be interrupted if someone chooses to. You should always wait until you see the login screen or the computer has powered off.
- 13. 11 Keep IT Safe – Virus Protection What is a Virus? A computer virus is a malware program that, when executed, replicates by inserting copies of itself (possibly modified) into other computer programs, data files, or the boot sector of the hard drive. When this replication succeeds, the affected areas are then said to be ‘infected’. Viruses often perform some type of harmful activity on infected hosts, such as stealing hard disk space or CPU time, accessing private information, corrupting data, displaying political or humorous messages on the user’s screen, SPAMming their contacts, logging their keystrokes, or even rendering the computer useless. What is Anti-virus? Anti-virus software is used to safeguard a computer from malware, including viruses, computer worms, and Trojan horses. Antivirus software may also remove or prevent spyware and adware, along with other forms of malicious programs. The detection used in these programs is reliant on the user performing regular anti-virus updates. On a University managed workstation, this update is performed automatically by the system administrators. However on personal devices such as laptops and home PCs, regular updates must be run. There are a number of free and commercially available anti-virus software packages such as AVG, ClamAV, McAfee, Norton and Kaspersky available on the market.
- 14. 12 Do • Do make sure portable devices such as USB sticks are clean before transferring the data from them • Do contact the Service Desk If you experience issues Don’t • Don’t open attachments from unknown or suspicious sources • Don’t click on links within emails Malware ‘Malware’ is short for malicious software. Malware infections on your computer or other data storage devices can have a serious impact, depending on what the malware was designed to do. For example, it can: • Corrupt or make important data inaccessible; • Introduce hidden software which can detect usernames and passwords to University systems, or personal data such as bank and credit card details, and transmit them to criminals to use in fraudulent activities
- 15. 13 Keep IT Safe – Virus Protection Spyware Spyware is any technology that aids in gathering information about a person or organisation without their knowledge. Spyware can get into a computer as a software virus or as a result of installing a new program, which could secretly capture your username, password, email address, banking credentials or credit card details. Usually visiting websites for free downloads, illegal software downloads, or illegal music downloads can often result in a Spyware infection. What is Anti-spyware? Anti-spyware is used to detect and remove malware and advertising software. Anti-spyware software such as ‘MalwareBytes’ can be used to remove spyware and malware. Do • Do avoid sites offering pirated software/videos and games • Do pay attention to freeware you install, much of it these days is packaged with spyware and users should be vigilant to ensure they only install what they want • Do make sure your Windows/MAC/Linux OS installation is up to date with the latest patches and updates • Do report to Service Desk and stop using immediately if you think your PC is infected with spyware Don’t • Don’t enter any personal details on websites unless the website is from a trustworthy organisation and you can verify it • Don’t open any email attachments that you are not expecting to receive. If it is a known sender, under no circumstances should you ever give out or send personal data back or follow any links unless you are absolutely sure
- 16. 14 What is a Firewall? A Firewall is software or hardware that monitors incoming and outgoing traffic and restricts or allows access to and from your computer depending on your firewall settings. Make sure you keep it turned on at all times.
- 17. Keep IT Safe– Data Handling The Data Protection Act states that you are responsible and liable for any personal or sensitive data you handle, so it is essential you do so securely. This section refers mainly to the handling of information on non-University devices. My Desktop Anywhere Whenever possible, remote access to University IT services should be via My Desktop Anywhere. This service is a secure method of working with your normal KU desktop from any device anywhere in the world. My Desktop Anywhere allows you to access University software applications and securely work on sensitive, personal or financial information without the need to save anything on your local device. My Desktop Anywhere can be accessed from both My Kingston at mykingston.kingston.ac.uk/tools/Pages/My-Desktop-Anywhere and StaffSpace staffspace.kingston.ac.uk/applications/Pages/My-Desktop-Anywhere USB Memory Sticks Popular for their ease of use, USB memory sticks are used by many people across the University to store and transport files and other data to work with remotely. USB memory sticks are an insecure method of storing information, and are easily lost or misplaced. The University strongly advises against the use of USB memory sticks to hold sensitive data unless they are encrypted. Encryption can be either ‘hardware encrypted’ in which case the USB device has a small numeric keypad on it, and access to data on the device requires entry of a valid PIN, or ‘software encrypted’ requiring the entry of a valid PIN or password once the device has been inserted and recognised by a computer. Encrypted USB sticks are available widely through high street and online stores. 15
- 18. Encryption Encryption, put simply, means the translation of data into a secret code. Encryption is the most effective way to achieve data security. To read an encrypted file, you must have access to a secret key or password that enables you to decrypt it. Full disk encryption ensures that everything stored on your device is encrypted. It is recommended that you consider using this facility to ensure the privacy of your data. On Windows computers you can use BitLocker, which is part of the standard Windows operating system, and the equivalent on Apple computers is FileVault. Before adopting either of these tools you should perform a full backup of your computer. Email encryption is supported by Office 365. However, the University does not offer email encryption as a standard service at this time, although it is expected that future Office 365 implementations at the University will include this. ‘Remember Me’ Many IT services require a username and password in order to identify and authenticate you. It is common for many computers to offer a ‘Remember Me’ function to avoid the need to enter these credentials every time you need to use the service. It is strongly recommended that you do not tick this option to ensure that your credentials are not stored on the computer. Email Attachments Email is an insecure communication medium. Email attachments are stored in temporary folders and will often remain there long after you have closed your email application and left the device. It is strongly recommended that information of a sensitive nature is not sent or viewed as an email attachment. Sending or Receiving Large Files Occasionally it may be necessary to transfer large files of information between the University and a third party. In such cases a secure file transfer protocol (FTP over SSL or FTPS) mechanism, or similar, should be used. If unsure, contact the Service Desk for assistance. 16
- 19. Keep IT Safe – Credit / Debit Card & Online Payments Telephone Payments When making payment over the telephone you should be careful that you are not overheard. When possible make sure that you are in a room alone, or can be certain that others are out of hearing distance. Online Payments When making payments using a website’s online payment facility, it’s important that the page you enter your details onto is using a secure connection. This ensures that your details are encrypted as they pass between your device and the supplier’s website over the internet. Always look for the padlock symbol in your web browser’s address bar, and the HTTPS:// prefix to the URL. If you are unsure or can’t easily identify it as being secure then don’t enter your details. When you do enter your details into a secure website it’s also important to make sure that nobody can see you do it. 17
- 20. Keep IT Safe – Reporting Security Incidents Remember, if your system suffers from a security incident, you should contact the Service Desk or email it-security@kingston.ac.uk 18 W portal.kingston.ac.uk NEED SUPPORT?Contact the Service Desk T 020 8417 3355 (internal)63355 OPENING HOURS Monday - Friday: 0800 - 1830 @KU_ServiceDesk Follow us on Twitter
- 21. V-01-04022016